1314 matches found
GLSA-200408-07 : Horde-IMP: Input validation vulnerability for Internet Explorer users
The remote host is affected by the vulnerability described in GLSA-200408-07 Horde-IMP: Input validation vulnerability for Internet Explorer users Horde-IMP fails to properly sanitize email messages that contain malicious HTML or script code so that it is not safe for users of Internet Explorer...
Apache Httpd < 2.0.51 : IPv6 URI parsing heap overflow
Testing using the Codenomicon HTTP Test Tool performed by the Apache Software Foundation security group and Red Hat uncovered an input validation issue in the IPv6 URI parsing routines in the apr-util library. If a remote attacker sent a request including a carefully crafted URI, an httpd child...
JShop Input Validation Hole in 'page.php' Permits Cross-Site Scripting Attacks
Indonesia Security Development Team Indohack http://indohack.sourceforge.net/drponidi =========================================================================== Security Advisory Advisory Name: JShop Input Validation Hole in 'page.php' Permits Cross-Site Scripting Attacks Platform: Linux Any, UN...
JetboxOne may allow unauthorized users to execute arbitrary code
Overview Lack of input validation in JetboxOne version 2.0.8 allows an user to upload arbitrary files to the vulnerable system. This could lead to the execution of arbitrary code. Description JetboxOne, an open-source content management system, could allow an attacker with "AUTHOR" privileges to...
Horde-IMP: Input validation vulnerability for Internet Explorer users
Background Horde-IMP is the Internet Messaging Program. It is written in PHP and provides webmail access to IMAP and POP3 accounts. Description Horde-IMP fails to properly sanitize email messages that contain malicious HTML or script code so that it is not safe for users of Internet Explorer when...
myServer 0.6.2 - math_sum.mscgi Multiple Remote Overflows
myServer 0.6.2 - mathsum.mscgi Multiple Remote Overflows source: https://www.securityfocus.com/bid/10831/info Reportedly MyServer is affected by multiple remote vulnerabilities in the 'mathsum.mscgi' example script. These issues are due to a boundary condition error and a failure to properly...
Horde-IMP: Input validation vulnerability
Background Horde-IMP is the Internet Messaging Program. It is written in PHP and provides webmail access to IMAP and POP3 accounts. Description Horde-IMP fails to properly sanitize email messages that contain malicious HTML or script code. Impact By enticing a user to read a specially crafted...
Re: [Full-Disclosure] iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File Creation/Truncation Vulnerability
Another minor issue has also been corrected in Opera Browser version 7.50, allowing malicious websites to spoof the address bar. The solutions remains the same, therefore no need to paste our full advisory here. However, if you wish further details, they can be found at:...
[Full-Disclosure] iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File Creation/Truncation Vulnerability
Opera Telnet URI Handler File Creation/Truncation Vulnerability iDEFENSE Security Advisory 05.12.04 www.idefense.com/application/poi/display?id=104&type=vulnerabilities May 12, 2004 I. BACKGROUND Opera is a cross-platform web browser. More information is available from http://www.opera.com/ II...
CVE-2003-0979
FreeScripts VisitorBook LE visitorbook.pl does not properly escape line breaks in input, which allows remote attackers to 1 use VisitorBook as an open mail relay, when $mailuser is 1, via extra headers in the email field, or 2 cause the guestbook database to be deleted via a large number of line...
Koch Roland Rolis Guestbook 1.0 - $path Remote File Inclusion
Koch Roland Rolis Guestbook 1.0 - $path Remote File Inclusion source: https://www.securityfocus.com/bid/9054/info It has been reported that Rolis Guestbook may be vulnerable to an input validation issue that may allow an attacker to include malicious files containing arbitrary code to be executed...
GuppY 2.4 - HTML Injection
source: https://www.securityfocus.com/bid/8717/info It has been reported that one of the scripts included with GuppY is vulnerable to an HTML injection attack. The script, "postguest.php", does not perform input validation to prevent the inclusion of HTML/script content in messages posted to the...
[Full-Disclosure] XSS in ezboard
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Issue : Cross site scripting in ezboard Vendor status : developers were contacted ezboard offers a free forum hosted at ... bla ... bla ... improper input validation .. bla ... bla ... script or HTML execution ... bla ... bla sorry but I don't have ti...
PHP-Nuke 5.x6.x Web_Links Module - SQL Injection
PHP-Nuke 5.x6.x WebLinks Module - SQL Injection source: https://www.securityfocus.com/bid/7558/info It has been reported that multiple input validation bugs exist in the WebLinks module used by PHPNuke. Because of this, a remote user may be able to access the database and potentially gain access ...
Working Resources 1.7.x/2.15 BadBlue - 'ext.dll' Command Execution
source: https://www.securityfocus.com/bid/7387/info BadBlue is prone to a vulnerability that could allow remote attackers to gain unauthorized access. This is due to an input validation issue in the 'ext.dll' component that could allow a remote attacker to cause '.hts' files to be interpreted by...
PHP-Nuke 5.6/6.x - 'banners.php' Banner Manager Password Disclosure
source: https://www.securityfocus.com/bid/7170/info It has been reported that an input validation error exists in the banners.php file included with PHPNuke. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to manipulate the database, and...
WebBoard does not adequately validate user input thereby permitting arbitrary JavaScript execution
Overview WebBoard does not adequately validate user input, allowing attackers to execute arbitrary JavaScript code on other WebBoard users' systems. Description WebBoard is a web application which includes a real-time chat server, using JavaScript alerts to display messages received by other user...
WebCalendar does not adequately validate user input
Overview WebCalendar does not properly validate user input, allowing attackers to execute arbitrary commands. Description WebCalendar is a free PHP application providing web calendar services for user groups. WebCalendar contains an unspecified input validation vulnerability, allowing arbitrary...
AdCycle does not adequately validate user input thereby allowing for SQL injection
Overview AdCycle does not adequately filter user input, allowing remote attackers to execute arbitrary MySQL queries. Description AdCycle is a shareware banner ad management system written in Perl and designed to work with a MySQL database. AdCycle does not adequately filter multiple unspecified...
MakeBook 2.2 - Form Field Input Validation
source: https://www.securityfocus.com/bid/4996/info The MakeBook guestbook software does not sufficiently sanitize potentially dangerous characters from form field input. This may enable attackers to inject arbitrary HTML into form fields, which will be stored on guestbook pages. Additionally, it...